Analysis

  • max time kernel
    111s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    27/09/2021, 08:03

General

  • Target

    #RS00HNAWZ1.js

  • Size

    6KB

  • MD5

    63166917fe9a799888f57c5d5e687170

  • SHA1

    00ac624acb5674ccd82c15370b1295c270d4e1ec

  • SHA256

    c6dd7fd1f49c9bfdba8c03b92d856a086c4ba218a204daa35ebaee0a91ab6a9d

  • SHA512

    6cdabe9785bcc8efe34468a1260454f096589c400f743809df9da450a77f3bd96a10cca0021f1b04b8150855e0e1f9a639b31e8ace41d66e26c23d2e7e68cc84

Malware Config

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 1 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\#RS00HNAWZ1.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\#RS00HNAWZ1.js
      2⤵
      • Creates scheduled task(s)
      PID:1136

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads